Buggy code:
private void indexPermissions ( SecureEntity entity ) { } private ImmutableSet < SecureEntity > getChildEntities ( SecureEntity entity ) { } private void indexEntityPermissions ( SecureEntity entity ) { } protected List < UserNotification > updateGenericPermissions ( SecureEntity entity , CustomAcl acl ) { List < UserNotification > notifications = Lists . newArrayList ( ) ; AppUser owner = userRepository . findOne ( Long . parseLong ( SecurityUtil . getUsername ( ) ) ) ; ObjectIdentity oid = new org . springframework . security . acls . domain . ObjectIdentityImpl ( entity ) ; AclImpl currentAcl = ( ( AclImpl ) ( aclService . readAclById ( oid ) ) ) ; currentAcl . setEntriesInheriting ( acl . getIsEntriesInheriting ( ) ) ; for ( int i = 0 ; i < ( currentAcl . getEntries ( ) . size ( ) ) ; i ++ ) { final AccessControlEntryImpl ace = ( ( AccessControlEntryImpl ) ( currentAcl . getEntries ( ) . get ( i ) ) ) ; if ( ( ( ace . getSid ( ) ) instanceof GrantedAuthoritySid ) && ( ( ( GrantedAuthoritySid ) ( ace . getSid ( ) ) ) . getGrantedAuthority ( ) . equals ( "ROLE_ADMIN" ) ) ) continue ; CustomAccessControlEntry customAce = Iterables . find ( acl . getEntries ( ) , new Predicate < CustomAccessControlEntry > ( ) { @ Override public boolean apply ( @ Nullable CustomAccessControlEntry customAccessControlEntry ) { if ( customAccessControlEntry == null ) return false ; return customAccessControlEntry . getId ( ) . equals ( ace . getId ( ) ) ; } } , null ) ; if ( customAce == null ) { currentAcl . deleteAce ( i ) ; } else { if ( ( customAce . getMask ( ) ) != ( ace . getPermission ( ) . getMask ( ) ) ) currentAcl . updateAce ( i , new com . gmi . nordborglab . browser . server . security . CustomPermission ( customAce . getMask ( ) ) ) ; } acl . getEntries ( ) . remove ( customAce ) ; } for ( CustomAccessControlEntry newAce : acl . getEntries ( ) ) { boolean isDuplicate = false ; Sid sid = null ; if ( newAce . getPrincipal ( ) . getIsUser ( ) ) { if ( ( userRepository . findOne ( Long . parseLong ( newAce . getPrincipal ( ) . getId ( ) ) ) ) == null ) break ; for ( AccessControlEntry ace : currentAcl . getEntries ( ) ) { if ( ( ace . getSid ( ) ) instanceof PrincipalSid ) { PrincipalSid checkSid = ( ( PrincipalSid ) ( ace . getSid ( ) ) ) ; if ( checkSid . getPrincipal ( ) . equals ( newAce . getPrincipal ( ) . getId ( ) ) ) { isDuplicate = true ; break ; } } } sid = new PrincipalSid ( newAce . getPrincipal ( ) . getId ( ) ) ; } else { if ( ! ( ALLOWED_AUTHORITIES . contains ( newAce . getPrincipal ( ) . getId ( ) ) ) ) break ; for ( AccessControlEntry ace : currentAcl . getEntries ( ) ) { if ( ( ace . getSid ( ) ) instanceof GrantedAuthoritySid ) { GrantedAuthoritySid checkSid = ( ( GrantedAuthoritySid ) ( ace . getSid ( ) ) ) ; if ( checkSid . getGrantedAuthority ( ) . equals ( newAce . getPrincipal ( ) . getId ( ) ) ) { isDuplicate = true ; break ; } } } sid = new GrantedAuthoritySid ( newAce . getPrincipal ( ) . getId ( ) ) ; } if ( ! isDuplicate ) { currentAcl . insertAce ( currentAcl . getEntries ( ) . size ( ) , new com . gmi . nordborglab . browser . server . security . CustomPermission ( newAce . getMask ( ) ) , sid , true ) ; if ( sid instanceof PrincipalSid ) { AppUser user = userRepository . findOne ( Long . parseLong ( ( ( PrincipalSid ) ( sid ) ) . getPrincipal ( ) ) ) ; UserNotification notification = new UserNotification ( ) ; notification . setAppUser ( user ) ; notification . setType ( "permission" ) ; String link = "" ; String userIcon = ( ( "<img<seq2seq4repair_space>class=\"img-circle\"<seq2seq4repair_space>src=\"" + ( PermissionServiceImpl . GRAVATAR_URL ) ) + ( owner . getAvatarHash ( ) ) ) + "&s=29\"<seq2seq4repair_space>//>" ; String objType = "" ; String objName = "" ; if ( entity instanceof Experiment ) { link = ( "//#//study//" + ( entity . getId ( ) ) ) + "//overview" ; objType = "study" ; objName = ( ( Experiment ) ( entity ) ) . getName ( ) ; } else if ( entity instanceof GWASResult ) { <START_BUG> link = "//#//gwasViewer;id=" + ( entity . getId ( ) ) ; <END_BUG> objType = "GWAS-result" ; objName = ( ( GWASResult ) ( entity ) ) . getName ( ) ; } else if ( entity instanceof CandidateGeneList ) { link = "//#//meta//candidategenelist//" + ( entity . getId ( ) ) ; objType = "candidategenelist" ; objName = ( ( CandidateGeneList ) ( entity ) ) . getName ( ) ; } String notificationText = ( ( userIcon + "<seq2seq4repair_space><span><a<seq2seq4repair_space>href=\"//#//profile//" ) + ( owner . getId ( ) . toString ( ) ) ) + "\">%s<//a><seq2seq4repair_space>shared<seq2seq4repair_space>a<seq2seq4repair_space><a<seq2seq4repair_space>href=\"%s\">%s<seq2seq4repair_space>(%s)<//a><seq2seq4repair_space>with<seq2seq4repair_space>you<//span>" ; notification . setText ( String . format ( notificationText , ( ( ( owner . getFirstname ( ) ) + "<seq2seq4repair_space>" ) + ( owner . getLastname ( ) ) ) , link , objType , objName ) ) ; notifications . add ( notification ) ; } } } aclService . updateAcl ( currentAcl ) ; return notifications ; } @ Override public List < AppUser > findAllUsers ( ) { } @ Override public SearchPermissionUserRole searchUserAndRoles ( String query ) { } }

Fix:
link = "//#//gwasViewer?id=" + ( entity . getId ( ) ) ;